CVE-2026-27540

CRITICAL EXPLOITED

WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-27540 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including DeadExpl0it, Nxploited.

AI-analyzed exploit summary The repository claims to be a PoC for CVE-2026-27540, an unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, but lacks actual exploit code. Instead, it directs users to a Telegram handle for the script, which is a common social engineering tactic.

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.

Exploits (2)

nomisec SUSPICIOUS 1 stars
by DeadExpl0it · poc
https://github.com/DeadExpl0it/CVE-2026-27540-WordPress-Exploit-PoC

The repository claims to be a PoC for CVE-2026-27540, an unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, but lacks actual exploit code. Instead, it directs users to a Telegram handle for the script, which is a common social engineering tactic.

Classification
Suspicious 95%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: WooCommerce Wholesale Lead Capture (version 2.0.3.1)
No auth needed
Prerequisites: none provided
devstral-2 · analyzed Apr 28, 2026 Full analysis →
github WORKING POC
by Nxploited · pythonpoc
https://github.com/Nxploited/CVE-2026-27542-CVE-2026-27540-

The repository contains a functional Python exploit for CVE-2026-27540, targeting an unauthenticated arbitrary file upload vulnerability in WordPress. The script includes methods for session handling, brute-forcing upload directories, and privilege escalation checks.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: WordPress (version not specified)
No auth needed
Prerequisites: WordPress installation with vulnerable plugin/theme · Network access to target
devstral-2 · analyzed May 01, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.0
EPSS 0.0047
EPSS Percentile 36.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

VulnCheck KEV 2026-02-20
CWE
CWE-434
Status published
Products (1)
Rymera Web Co Pty Ltd./Woocommerce Wholesale Lead Capture < 2.0.3.1
Published Mar 19, 2026
Tracked Since Mar 19, 2026